MongoDB 8.0.23 - OIDC authentication via Keycloak

MongoDB
, , ,
1

Hi

While to setup and test OIDC authentication for Percona MongoDB 8.0.23 using Keycloak - the authentication does not work.

I tried using mongosh ( ubuntu host ) and also via MongoDB Compass

On MongoDB Compass side - I am little further and get this error message

“$external”,“error”:“BadValue: Invalid JWT :: caused by :: unsupported issuer or audience”,

while on the mongosh side - I get this message -

Error: Unable to fetch issuer metadata for <https://youknow.what.com/realms/Mongodb"

Any one has faced this situation and any feedback/suggestion ?

Thank you in advance

2

Hello @pshah,

Thank you for the question. To conduct a deeper analysis, we need more information.

Could you please provide detailed steps to reproduce the issue, including the exact commands used and your Keycloak and mongod configurations?

Thanks in advance

4

Thanks for reaching out to me.

Since yesterday - I was trying to find a solution for this problem. I got little success with connecting from MongoDB compass but not from mongosh ( Ubuntu host )

When i used curl to find out what access token I was getting - from Keycloak - I found out that there were 2 audience values were reported - mongodb-client ( which I wanted ) and also account. While trying to research this - I found out from web - on how to remove the account (audience default value).

Once I was able to fix that - I got these values for Keycloak ( modifed for viewing here )

{
“exp”: 1782496554,
“iat”: 1782496254,
“jti”: “2e61e825-9032-41e2-9bf7-65e72219e510”,
“iss”: “realms/Mongodb",
“aud”: “mongodb-client”,
“sub”: “myemailaddress",
“typ”: “Bearer”,
“azp”: “mongodb-client”,
“sid”: “d6168019-b043-402b-b729-53b1e197675c”,
“acr”: “1”,
“scope”: “profile email”,
“email_verified”: true,
“name”: “myname”,
“preferred_username”: “myemailaddress",
“given_name”: “my first name”,
“MyClaim”: [
“/database_admin”
],
“family_name”: “my last name”,
“email”: “myemailaddress"
}

My mongodb OIDC values in mongod.conf

setParameter:
authenticationMechanisms: MONGODB-OIDC, PLAIN, SCRAM-SHA-1, SCRAM-SHA-256
oidcIdentityProviders: ‘[ {
issuer: "”realms/Mongodb,
clientId: “mongodb-client”,
audience: “mongodb-client”,
authNamePrefix: “keycloak”,
principalName: “preferred_username”,
useAuthorizationClaim: true,
supportsHumanFlows: true,
authorizationClaim: “MyClaim”
} ]’

MongoDB Compass - some of the setting needed - direct access / redirect address / trusted host / host were the instance is running etc.

Later - MongoDB Compass is able to connect to MongoDB instance

on the Ubuntu host - mongosh fails still - even when MongoDB compass works.

error reported -

Error: Unable to fetch issuer metadata for “realms/Mongodb": something went wrong (caused by: The operation was aborted.)

in mongodb log

“error”:“AuthenticationAbandoned: Authentication session abandoned, client has likely disconnected”

5

Hello @pshah,

We are tracking this issue in Jira ticket PSMDB-2162.

Regards,
Konstantin.